Insights

"Consent shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action."

— DPDPA Section 6

"Any service provider shall mandatorily report cyber incidents to CERT-In within 6 hours."

— CERT-In Directions 2022

"The Central Government may notify any Data Fiduciary as a Significant Data Fiduciary based on volume and sensitivity of personal data processed."

— DPDPA Section 10(1)

"The Central Government may restrict transfer of personal data to such country or territory outside India as may be notified."

— DPDPA Section 17

"The Data Fiduciary shall, before processing any personal data of a child, obtain verifiable consent of the parent of such child."

— DPDPA Section 9(1)

"Consent must be free, informed, specific, and unambiguous—dark patterns directly contradict these requirements."

— DPDPA Compliance Principle

"The Data Principal shall have the right to obtain from the Data Fiduciary confirmation whether personal data is being processed."

— DPDPA Section 11(1)

"A Data Fiduciary is any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data."

— DPDPA Section 2(i)

"The 18-month milestone represents a cliff edge—significant effort will be required for sanitizing legacy data."

— Implementation Advisory

"When personal data is shared, a Data Sharing Agreement is mandatory under DPDPA—NDAs and MOUs are insufficient."

— Contractual Compliance Principle

"The Data Protection Board may, after giving reasonable opportunity of being heard, impose a monetary penalty not exceeding ₹250 crores."

— DPDPA Section 33

"A Significant Data Fiduciary shall appoint a Data Protection Officer who shall be based in India."

— DPDPA Section 10(2)(a)

"While DPDPA draws inspiration from GDPR, significant structural differences demand distinct compliance approaches."

— Comparative Analysis

"Data localisation in India operates through sector-specific regulations rather than DPDPA general mandate."

— Regulatory Framework

"A Consent Manager shall be registered with the Board and shall act on behalf of a Data Principal."

— DPDPA Section 2(g)

"A Significant Data Fiduciary shall undertake Data Protection Impact Assessment."

— DPDPA Section 10(2)(c)

"Personal data may be processed without consent for specified legitimate uses."

— DPDPA Section 7

"Personal data means any data about an individual who is identifiable by or in relation to such data."

— DPDPA Section 2(t)

"The Data Processor shall process personal data only in accordance with the instructions of the Data Fiduciary and shall not process such personal data for any purpose other than the purpose for which it was provided."

— DPDPA Section 8(2)

"Every Data Fiduciary shall publish the business contact information of a Data Protection Officer or such other person who is able to answer on behalf of the Data Fiduciary, the questions, if any, raised by the Data Principal about the processing of her personal data."

— DPDPA Section 13(1)

"The Data Processor shall process personal data only in accordance with the instructions of the Data Fiduciary and shall not process such personal data for any purpose other than the purpose for which it was provided."

— DPDPA Section 8(2)

"A Data Fiduciary may process the personal data of a Data Principal for certain legitimate uses including the performance of any function under any law, compliance with any order or judgment, or for responding to a medical emergency."

— DPDPA Section 7

"The penalty for failure to take reasonable security safeguards to prevent personal data breach shall be up to two hundred and fifty crore rupees."

— DPDPA Schedule, Item 1

"The Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force, erase personal data upon the Data Principal ceasing to be a customer or withdrawing consent."

— DPDPA Section 8(7)

"The Central Government hereby makes the following rules, namely:— 1. Short title and commencement.— (1) These rules may be called the Digital Personal Data Protection Rules, 2025."

— G.S.R. 846(E), Gazette of India, 13 November 2025

"This Act applies to the processing of digital personal data within the territory of India where the personal data is collected in digital form or in non-digital form and digitised subsequently."

— DPDPA Section 3(a)

"A Data Fiduciary shall engage, appoint or use a Data Processor to process personal data on its behalf only under a valid contract."

— DPDPA Section 8(2)

"This Act applies to the processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India."

— DPDPA Section 3(b)

"Every person who has been a Data Fiduciary shall, after ceasing to be so, comply with the obligations under this Act in respect of the personal data processed by that person while being a Data Fiduciary."

— DPDPA Section 8(8)